CVE-2026-28525: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-28525 is an integer underflow vulnerability in SWUpdate's multipart upload parser (mongoose_multipart.c) that allows unauthenticated remote attackers to cause a denial of service. The flaw affects SWUpdate versions up to and including 2025.12. It was discovered by Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc., disclosed on April 23, 2026, and assigned by VulnCheck. It carries a CVSS v3.1 score of 6.8 (Medium) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, VulnCheck Commit).

The root cause is a discrepancy between a guard condition and a subsequent subtraction in mg_http_multipart_continue_wait_for_chunk() within mongoose/mongoose_multipart.c (CWE-191: Integer Underflow; CWE-125: Out-of-bounds Read). The guard at line 250 checks (int) io->len < mp_stream->boundary.len + 6, permitting execution to continue when io->len >= boundary.len + 6. However, in the else branch, data_len is computed as io->len - (mp_stream->boundary.len + 8) — a +6 vs. +8 mismatch. When io->len falls in the range [boundary.len + 6, boundary.len + 7], the subtraction underflows the size_t variable to SIZE_MAX or SIZE_MAX - 1, triggering an out-of-bounds heap read that sends data past the allocated receive buffer to a local IPC socket. Exploitation requires a crafted HTTP POST to /upload with a malformed multipart boundary and controlled TCP stream timing (VulnCheck Commit).

Successful exploitation results in a denial of service condition, causing the SWUpdate service to become unavailable. The out-of-bounds heap read can write data beyond the allocated receive buffer to a local IPC socket, potentially destabilizing the update service on embedded Linux devices. There is no known confidentiality or integrity impact; the scope is changed (S:C in CVSS v3.1) due to the IPC socket interaction, but lateral movement or data exfiltration are not demonstrated consequences of this vulnerability (GitHub Advisory, VulnCheck Commit).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.035% (Feedly data) to 0.098% (GitHub Advisory), placing it in a low exploitation probability range. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity due to the need for controlled TCP stream timing (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible SWUpdate instances running version 2025.12 or earlier, particularly those with the HTTP upload endpoint (/upload) exposed.
2. Craft malformed multipart request: Construct an HTTP POST request to /upload with a multipart boundary chosen such that the resulting buffer length (io->len) falls in the range [boundary.len + 6, boundary.len + 7] after partial TCP delivery.
3. Control TCP stream timing: Deliver the crafted request in segments, ensuring the server's receive buffer is in the vulnerable size range when mg_http_multipart_continue_wait_for_chunk() is invoked — this requires precise timing of TCP packet delivery.
4. Trigger integer underflow: When the boundary is found in the buffer and data_len = io->len - (boundary.len + 8) is computed with io->len in the vulnerable range, the size_t underflows to SIZE_MAX or SIZE_MAX - 1.
5. Achieve denial of service: The out-of-bounds heap read causes the SWUpdate service to crash or become unresponsive, disrupting the software update mechanism on the target device (VulnCheck Commit).

• Network: Unusual or repeated HTTP POST requests to /upload endpoint with malformed or unusually short multipart boundary strings; TCP connections with abnormal segmentation patterns or deliberate pacing to the SWUpdate HTTP port.
• Logs: SWUpdate service logs showing crashes, unexpected restarts, or errors originating from mongoose_multipart.c; HTTP access logs with POST requests to /upload containing malformed Content-Type: multipart/form-data headers.
• Process: Unexpected termination or restart of the SWUpdate daemon process; core dump files generated by the SWUpdate process in the system's crash directory.

The vulnerability is patched in commit beee2dc of the SWUpdate repository, which corrects the +8 to +6 in the data_len computation and the subsequent mg_iobuf_del call, aligning them with the guard condition. Users should update to a version of SWUpdate that includes this fix (post-2025.12). Until patching is possible, recommended mitigations include: restricting network access to the /upload endpoint via firewall rules or access controls; disabling multipart upload functionality if not required; and implementing rate limiting on the upload endpoint to reduce attack surface (VulnCheck Commit, GitHub Advisory).

The vulnerability was reported by Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc., and acknowledged by SWUpdate maintainer Stefano Babic in the patch commit. Red Hat has tracked the CVE in their security advisory system. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database entries.